module_kernel.ko

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter.h>
#include <linux/ip.h>
#include <linux/tcp.h> 

MODULE_LICENSE("GPL");
MODULE_AUTHOR("user");
MODULE_DESCRIPTION("Filtering CVE-2018-11776.");

static struct nf_hook_ops nfho_in;

#define MIN_HTTP_REQ_LEN 16


unsigned int hook_func(unsigned int hooknum, struct sk_buff *skb,
		const struct net_device *in, const struct net_device *out,
		int (*okfn)(struct sk_buff *)) {

        if (!skb) // empty network packet
                return NF_ACCEPT;

        struct iphdr *ip_header = (struct iphdr *)skb_network_header(skb); 
        struct tcphdr *tcp_header;
        if (ip_header->protocol != IPPROTO_TCP)
                return NF_ACCEPT;

        unsigned char *tcp_data;
        unsigned char *tail;
        int data_length;

        tcp_header = tcp_hdr(skb);
        tcp_data = (unsigned char *)((unsigned char*)tcp_header + (tcp_header->doff * 4));
        tail = skb_tail_pointer(skb); // points to the end of the data

        data_length = tail - tcp_data;

        if(data_length < MIN_HTTP_REQ_LEN)           	
		return NF_ACCEPT;
	

	if (strstr(tcp_data,"GET")!=NULL){
		if(strstr(tcp_data, "allowStaticMethodAccess")!=NULL){
		printk(KERN_INFO "blocked packet\n");
		return NF_DROP;
		}
	}
        
 return NF_ACCEPT;

}

static int __init kernel_mod_init(void) {
 	printk(KERN_INFO "Install module!\n");
 	nfho_in.hook = (nf_hookfn *)hook_func;
 	nfho_in.hooknum =  NF_INET_POST_ROUTING;
 	nfho_in.pf = PF_INET;
 	nfho_in.priority = NF_IP_PRI_FIRST;
 	nf_register_hook(&nfho_in); // Register the hook 
 	return 0;
}
static void __exit kernel_mod_exit(void) {
 	printk(KERN_INFO "Uninstall module!\n");
 	nf_unregister_hook(&nfho_in);
}


module_init(kernel_mod_init);
module_exit(kernel_mod_exit);